Lucene search

IcscertCVE-2015-7923

HistoryJan 30, 2016 - 12:59 p.m.

CVE-2015-7923

2016-01-3012:59:00

CWE-310

icscert

web.nvd.nist.gov

cve-2015-7923

ssl

private key

cryptographic protection

man-in-the-middle attack

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

44.6%

JSON

Westermo WeOS before 4.19.0 uses the same SSL private key across different customers’ installations, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.

Affected configurations

Nvd

Node

westermoweosMatch4.18.0

VendorProductVersionCPE
westermoweos4.18.0cpe:2.3:o:westermo:weos:4.18.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
westermo	weos	4.18.0	cpe:2.3:o:westermo:weos:4.18.0:::::::*

References

ics-cert.us-cert.gov/advisories/ICSA-16-028-01

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

44.6%

JSON

Related for CVE-2015-7923